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(54) System and method for detecting cloning fraud in cellular PCS communications 



(57) A system and method lor proactively detecting 
cloning traud in a cellular mobile telephone environment 
are discussed. Inlormation is collected vtfhich corre- 
sponds to registration notilications o1 the cellular tele- 
phones as they operate v^ithin the cellular mobile tele- 
phone environment. The registration inlormation is used 
to detect lime-space peculiarities. Specifically, registra- 



tions having the same mobile identification number and 
occurring in ditlerent mobile switching centers within a 
predetermined time interval are identified. This time in- 
terval, based on a reasonable travel time between cells 
covered by the ditlerent mobile switching centers where 
the registrations originated^ is used as a threshold lor 
detecting cloning fraud. 
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Description 

Background of the invention 

1 Field of the Invention 

The present invention relates qenerally 1o ceHu- 
lar/PCS (Personal Connmunications Services) tele- 
phone communications. Specilically, the present inven- 
tion relates to detecting cloning traud in a cellular/PCS 
environment. 

2 Related Art 

Cellular mobile telephone systems provide direct- 
dia^ telephone service to mobile users by using radio 
transmission. The service area ot a cellular mobile tel- 
ephone system is divided into regions called celts. With- 
in each cell is a base station which includes a transmitter 
and a receiver. Each base station is connected lo a mo- 
bile switching center (MSG) which processes calls to 
and trom mobile users located in the cell. Each trans- 
mitter and receiver operates on a voice channel (Ire- 
quency). A single channel may be used tor many simul- 
taneous conversations (voice signals) in cells which are 
sufticiently separated from one another such that exces- 
sive interlerence is avoided. However, as the number o1 
mobile users increases within a celL the cell may be- 
come too crowded to provide adequate separation. 
When a cell becomes overcrowded, the cell must be 
split into smaller cells with each cell covering a smaller 
geographic area. Each new cell requires a new base 
station which is connected to the original MSG. Thus, 
as the number of cells increases, each MSG may be 
processing calls tor multiple cells. 

As a mobile user travels with his cellular telephone 
powered up, the cellular telephone autonomously reg- 
isters the mobile user by sending signals with informa- 
tion identifying the mobile user to the MSG serving the 
cell where the mobile user is currently located. The 
sending and receipt of such information is referred to as 
registration notification. The information included in a 
registration notification is the mobile user's mobile iden- 
tification number (MIN) and an electronic serial number 
(ESN). The MIN uniquely identities each mobile user in 
a manner similar to a conventional telephone number. 
The ESN is encoded into each cellular telephone. The 
ESN functions as a security password verifying the va- 
lidity of the MIN and allowing the mobile user access to 
the cellular mobile telephone system. 

The MSG collects registration notifications and pro- 
vides them to other facilities in the cellular mobile tele- 
phone system. These facilities primarily use the regis- 
tration notifications to facilitate incoming and outgoing 
calls. Typically, a mobile user subscribes tor services 
with the MSG covering the cell: or group of cells where 
the mobile user primarily resides or conducts business 
Th is MSG is referred to as the mobile user's home MSG. 



All other MSGs in the cellular mobile telephone system 
are known as visited MSGs with respect to the mobile 
user When a mobile user ventures beyond the cells cov- 
ered by the home f^SC. the mobile user is said to be 
B "visiiing." For purposes of this discussion, a mobile user 
inside a cell of a visited MSG is referred to as a visiting 
mobile user. 

When a mobile user powers on his cellular tele- 
phone or crosses cell boundaries covered by different 

TO MSGS: the cellular telephone, at some point, autono- 
mously sends a signal representing a registration noti- 
fication. The MSG covering the cell (i.e.: either a home 
f\/ISC or a visited MSG) receives the registration notifi- 
cation. Based on the MIN and ESN contained in the reg- 

TS istration notification, the MSG queries a Roamer Valida- 
tion and Call Delivery (RVGD) facility to validate the mo- 
bile user's subscription information. The RVGD stores 
the subscription information lor all mobile users in the 
cellular mobile telephone system in a Home Location 

^0 Register (HLR). The HLR identilies each of the mobile 
users home MSG^ the sen/ices to which each mobile 
user IS subscribed, and whether each subscription is 
valid. 

After receiving a query from the MSG, the RVGD 
2B responds by sending the requested the information in: 
eluded in the HLR back tothe querying MSG. The MSG 
maintains this information to provide cellular mobile tel- 
ephone services to the mobile user as long as the mobile 
user remains in cells covered by the MSG. 
30 Registration notification is important for several rea- 
sons. Primarily, registration notification is used to pro- 
vide cellular mobile telephone services to mobile users 
outside of the cells o1 the home MSG (as described 
above). Thus, a mobile user can utilize cellular mobile 

35 telephone services throughout the cellular mobile tele- 
phone system. 

Registration notification is also important for routing 
incoming calls to mobile users. When an incoming call 
is to be routed to a mobile user, the mobile user must 

40 be located so that the call can be routed through the 
proper MSG to the mobile user In the case of a conven- 
tional telephone user (i.e., not a mobile user) attempting 
to place a call to a mobile user, the home MSG receives 
the incoming call from the regular telephone user and 

4S determines whether the mobile user is active, or oper- 
ating, in the cell of the home MSG. If the mobile user is 
not active within the cell of the home MSG, the mobile 
user may: 1) not have his telephone powered up, or 2) 
be active in the cell of a visited MSG. In the first case, 

so the incoming call cannot be routed to the mobile user. 
In the second case, the RVGD attempts to locate the 
mobile user within the cellular telephone system. 

The RVGD functions as a clearing house for a cel- 
lular mobile telephone system. Specifically, the RVGD 

55 validates mobile users and manages activation, deacti- 
vation, and changes in subscription profiles of mobile 
users The RVGD also stores a copy of each registration 
notification received from the MSGs. Furthermore, the 
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RVCD updates ihe HLR to indicate the MSG where the 
latest registration notitication originated (this is called 
the originating MSG). This allows the RVGD to track 
where each rriobile user is currently located in the cel- 
lular mobile telephone system. 

Tracking mobile users within the cellular mobile tel- 
ephone system serves to lacilitate the routing o1 incom- 
ing calls to mobile users When an incoming call is 
placed to a mobile user who is not within the cell o1 the 
home MSG: the home MSG can query the RVCD to lo- 
cate the mobile user based on the origination ot the reg- 
istration notilication maintained in the HLR. The the in- 
coming call can then be routed to the originating MSG 
which connects the incoming call via radio communica- 
tion signals to the mobile user. In the prelerfed embod- 
iment, U^fO RVCD systems are used in parallelto provide 
backup tor the cellular mobile telephone system in case 
one RVGD should tail. 

A problem existing in current cellular mobile tele- 
phone systems is cloning fraud. Gloning fraud occurs 
when one mobile user (called an unauthorized user) ob- 
tains and traudulently uses the MIN and ESN registered 
to another mobile user (called an authorized user) in or- 
der to obtain "tree" service. As used herein^ the term 
"valid MIN" reiers to a MIN when being used by an au- 
thorized mobile user. The term "cloned MIN" reiers to a 
MIN when being used by an unauthorized mobile user 

The cellular mobile telephone system uses the MIN 
and ESN associated with each mobile telephone call to 
bill the authorized mobile user registered with that MIN 
and ESN. When a MIN and ESN are "cloned", the au- 
thorized mobile user gets billed tor calls nnade with the 
valid MIN and well as those calls made using the cloned 
MIN. Cloning fraud costs the cellular telephone industry 
millions of dollars in lost revenue each year. What is 
needed is a means lor detecting cloning fraud in a ce!- 
lular/PGS environment. 

Summary of the Invention 

The present invention is directed to a system and 
method for proactively detecting cloning fraud in a cei- 
lular/PCS (Personal Communications Services) envi- 
ronment. According to the invention, the system detects 
cloning fraud by comparing the time and location of rec- 
istration notifications having the same mobile identifica- 
tion number (MIN). Gloning fraud is reported when the 
computed time difference between such registration no- 
tifications is less than a leasonable travel time between 
the cells of the originating mobile switching centers 
(originating MSCs). 

Further features and advantages of the present in 
vention, as well as the struct ure and operation o1 various 
embodiments of the present invention, are described in 
detail below with reference to the accompanying draw- 
ings. 



Briel Description ot the Drawings 

The present invention is described with reference 
to the accompanying drawings. In the drawings, like ref- 
s erence numbers indicate identical or functionally similar 
elements. Additionally, the left-most digit(s) of a refer- 
ence number identifies the drawing in which the refer- 
ence number first appears, 

10 FIG. 1 illustrates a cellular mobile telephone envi- 
ronment: 

FIG. 2 illustrates a block diagram of a cellular mobile 
telephone system according to a preferred embod- 
iment of the present invention; 

7f FIG. 3 illustrates a block diagram of a clone detec- 
tion system (CDS) according to a preferred embod- 
iment ot the present invention; 
FIGS. 4 and 5 are flow charts depicting the pre- 
ferred operation of the present invention; and 

20 FIG. 6. illustrates an example clone detection table 
used by the invention. 

Detailed Description of the Embodiments 

FIG. 1 illustrates a cellular mobile telephone envi- 
ronment 100 Cellular mobile telephone environment 
TOO includes a plurality o1 cells 110. Each cell 110 in- 
cludes a base station (not shown) for transmitting and 
receiving radio signals to and Irom mobile users 1 30. 

30 Each base station is connected to a mobile switching 
center (MSG) 120. One or more mobile users 130 may 
be positioned in each cell 110 at any time. For ease of 
discussion, it is assumed that each MSG 1 20 is connect- 
ed to one base station, and that each MSG 120 covers 

S£' one cell 1lO. However, it will be apparent to one skilled 
in the art that such a limitation is unnecessary. In fact, 
each MSG 1 20 is usually connected to several base sta- 
tions, and ihuS: is responsible for covering multiple cells 
no. 

40 FIG. 2 Illustrates a block diagram o1 a cellular mobile 
telephone system 200 according to a prelened embod- 
iment of the present invention Cellular mobile tele- 
phone system could comprise a nationwide telephone 
system. Cellular mobile telephone system 200 includes 

■^s a PCS Sen/ice Management System (PSMS) 202, a first 
Roamer Validation and Call Delivery system (RVCD) 
204A: a second RVCD 204B, a plurality of MSCs 120, 
and a plurality of mobile users 1 30. As discussed above, 
a base station (not shown) is positioned in each cell 110. 

50 Each base station is connected to a MSG 120. An MSG 
1 20 may be connected to one or more base stations thus 
covering one or more cells 110. Each of the MSCs 120 
is connected to either RVCD 204A or RVGD 204B. 
which are centrally located within cellular mobile tele- 

5£ phone system 200. The RVCDs 204 are connected to 
each other to provide rerouting in the event that one 
fails Both RVCDs 204 are connected to PSMS 202 
which is also centrally located within cellular mobile tel- 
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ephone system 200. In the prelerred embodiment, the 
MSCs 120 are connected to the-RVCDs 204 using IS- 
4T protocol over SS7 or X.25. The RVCDs 204 are con> 
nected to the PSMS 202 via an X.25 packet network. A 
person skilled in the art will recognize that other connec- ^ 
lion protocols and networks may alternatively be used. 

In general a mobile user 1 30 registers with a MSC 
1 20 by sending its MIN and ESN using well known wire- 
less communication techniques (i.e., via a radio signal 
220). Radio signal 220 containing mobile user's Ml N and to 
ESN is sent ai a predetermined time interval while the 
mobile user 130 is operating to notity the MSC 120 ot 
its presence within the cell nO where the MSC 120 is 
located. This is referred to as registration notitication. 
The MSC 120 receives the radio signal 220 as a regis- 75 
tration notitication (REGNOT) query. A REGNOT query 
includes a MIN, a time stamp representing a time when 
the registration notitication was received by the MSC 
120, and an originating MSC indicia identilying which 
MSC 120 received the registration nolilication.. The 
MSC 120 sends the REGNOT query to one ot the 
RVCDs 204 which processes the REGNOT query and 
creates a record o1 the query lor subsequent retrieval 
by PSMS 202 (described below). 

For example, at 10:30 am, a mobile user 130G op- 
erating in a cell 110G sends a radio signal 220 contain- 
ing a registration notification. The MSC 120G receives 
the signal 220 and creates a REGNOT query The REG- 
NOT query includes the mobile user l30G's MIN, a lime 
stamp of 10:30 am (i.e., the time when the registration 30 
notification was received), and an originating MSC indi- 
cia identifying MSC 120G (i.e., the identity of the MSC 
receiving the registration notification) The REGNOT 
query is sent to either RVCD 204A of RVCD 204B which 
stores the query as a REGNOT record. 35 

As discussed previously, each RVCD 204 functions 
as a clearing house lor the cellular mobile telephone 
system 200 by maintaining information regarding the 
mobile users 130. This information includes the cellular 
mobile telephone services to which each nrK>bile user 
130 subscribes and the cell where each operating mo- 
bile user 130 is currently located. RVCDs 204 maintain 
this information in a master list referred to as e Home 
Location Register (HLR). The informalion regarding the 
cell where each operating mobile user 130 is currently ^6 
located is updated from REGNOT queries received from 
the MSCs 120. At a predetermined time interval (i.e. de- 
termined by individual system implementation require- 
ments), each RVCD 204 sends the REGNOT records to 
the PSMS 202 which performs various processing o1 the ^o 
inlormation. The PSMS 202 includes e clone detection 
system (CDS) 210 which processes the REGNOT 
records to identity instances ot cloning Iraud 

FIG. 3 illustrates a block diagram of the clone de- 
lection system (CDS) 21 0 according to a prelerred em- 55 
bodimenl of the present invention. The CDS 210 in- 
cludes a REGNOT record collector 302, a REGNOT 
record file 312, a fraud manager 304, a clone detection 



time table 306, a clone detection window 308. a clone 
record file 314, and a report generator 3i6. 

The PSMS 202 receives the REGNOT records, in- 
dicated by reference number 316 in FIG. 3. from the 
RVCDs 204. The REGNOT record collector 302 collects 
these REGNOT records 316 and stores them in the 
REGNOT record file 312. In the preferred embodiment, 
the PSMS 202 receives new REGNOT records 3181 rom 
the RVCDs 204 every thirty minutes. The REGNOT 
records 316 received during each thiny minute interval 
are stored in the REGNOT record file 312 as a group. 
Each group of REGNOT records 316 so stored is re- 
lerred to as a "hall hour data group" 31 0 

Fraud manager 304 collects several half hour data 
groups 31 0 from the REGNOT record file 31 2 and forms 
a clone detection window 30E (such halt hour data 
groups 310 are stored in memory, such as random ac- 
cess memory). The clone detection window 306 collec- 
tively represents all registration notitications (represent- 
ed by REGNOT records 318) received by Ihe MSCs 120 
within the cellular mobile telephone system 200 during 
a predetermined time frame. In the preferred embodi- 
ment, the Iraud manager 304 forms a clone detection 
window 308 from the most recent thirteen half hour data 
groups 310 arranged from oldest in time to newest in 
time. Accordingly the clone detection window 308 rep- 
resents all registration notifications received within the 
past 6.5 hours by all MSCs 120 in the cellular mobile 
telephone system 200 

Clone detection window 308 is a sliding window, 
representing registration notifications occurring within a 
specified time interval (i.e. the last 6.5 hours). As the 
window "slides" (i.e. time passes), new registration no- 
tifications are added to the window and old ones are re- 
moved. Thus, only those registration notifications occur- 
ring within the specified time interval are processed to- 
gether by fraud manager 304. 

The Iraud manager 304 determines whether cloning 
fraud exists by determining whether time-space peculi- 
arities exist within the clone detection window 308. A 
time-space peculiarity exists when registration notifica- 
tions with the same MIN originated in diflerent locations 
within a time insufficient to travel between the different 
locations In such cases, at least one ot the registration 
notitications is likely to be an instance ot cloning Iraud. 

In the preferred embodiment, the fraud manager 
304 detects cloning fraud by comparing the ditterence 
between the lime stamps ol the REGNOT records 31 6 
in the clone detection window 306 having the same MIN 
with a reasonable travel time between the locations ol 
the cells ol the originating MSCs. For example, referring 
to FIG. 1 , suppose the MSC 1 20A receives a registration 
notitication indicating a MIN ol X Irom the mobile user 
l30Aat 10:00 a.m. Later, the MSC 120C receives a reg- 
istration notification also indicating a MIN of X from the 
mobile user 130C at 10:45 a m Suppose thsl a reason- 
able travel time between cell 110A and cell HOC is 80 
minutes. When the fraud manager 304 processes the 
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REGNCT records 3^B in the clone detection window 
310: il will loc?^le these two reoislralion nolifications hav- 
ing the same MIN o1 X. The Iraud manager 304 will de- 
termine that one registration nolilication was received 
by the MSC 120A in cell nOA while the other was re- 
ceived by the MSC 120C in cell nOC. The Iraud man- 
ager 304 will determine that the registration notilications 
occurred 45 minutes apan trom one another. By com- 
paring this time ditlerence (45 minutes) with the reason- 
able travel time (80 minutes), the Iraud manager 304 will 
conclude that an instance o1 cloning iraud has occurred. 

The previous example has been provided to illus- 
trate the operation o1 the clone detection system 210 
and not as a limitation. In the prelerred embodiment, the 
clone detection window 30e is 6.5 hours wide (chosen 
as the minimum reasonable lime to travel across the 
United States) and encompasses a much larger time 
trame than the example illustrates. Funhermore^ it 
would be apparent lor one skilled in the an to adjust the 
width of the clone deleclion window 306 depending on 
the geographic aiea covered by the cellular mobile tel- 
ephone system 200. 

Relerring again to FIG. 3. in the preferred embodi- 
ment: reasonable travel times between the cells 110 
covered by different MSCs 120 of the cellular mobile tel- 
ephone system 200 are stored in a clone detection time 
table 306. The clone detection time table 305 includes 
the reasonable travel time between cells 110 covered 
by a pair of MSCs 120. For cells 110 covered by a pair 
of adjacent MSCs 120 (e g , MSC 120A and MSC 
1 20B), the travel time is zero because a mobile user 1 30 
could register with either MSC 120 as the mobile user 
130 crosses cell boundaries. For each pair ot nonadja- 
cent MSCs 120 (e.g.= MSC n OA and MSC 110D), a rea- 
sonable travel time is determined based on the time a 
mobile user 1 30 would take to travel out o1 cells 1 1 0 cov- 
ered by a first MSC 1 20 and into cells 110 covered by a 
second MSC 120. This reasonable travel time is stored 
in clone detection time table 305 and is retrieved using 
the originating MSC from each of the REGNOT records 
as indices into the table An example clone detection 
lime table 306 is illustrated in FIG. 6. For example, the 
reasonable travel time between cells 110 covered by 
MSCs 120 A and 120D is found by using the first REG- 
NOT originating MSC as MSC A and the second REG- 
NOT originating MSC as MSC D to retrieve 1 20 minutes 
as the reasonable travel time 

The preferred embodiment uses RVCDs 204 to 
store the HLR and collect the REGNOT queries for each 
of the MSCs 110. One skilled in the art would recognize 
that other implementations or divisions o1 processing 
could be utilized for clone detection system 2i0. For ex- 
ample^ the PSMS 202 could be directly connected to 
each MSC 110 and handle the registration notifications 
without any RVCDs 204. Furthermore., data could be 
processed in other that half hour increments^ or in fact, 
immediately upon receipt. 

FIG. 4 illustrates a flow diagram o1 a preferred im- 
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plementation of the processing performed by the fraud 
manager 304 during clone detection. In a step 402. the 
fraud manager 304 forms a clone detection window 308 
from preferably the most recent in time thirteen hall hour 

s data groups 3l0 retrieved from REGNOT record tile 
31 2. As discussed above, the data is arranged from the 
oldest REGNOT record to the newest REGNOT record. 

In a step 404. the fraud manager 304 reads a MIN 
from a first REGNOT record 3l£, (i.e.. the oldest record 

10 with respect to time) in the clone detection window 30E. 
In a step 406, the fraud manager 304 reads a MIN from 
a second REGNOT record 3l6 in clone detection win- 
dow 308. In a decision step 408. the fraud manager 304 
compares the MIN trom the first REGNOT record with 
the MIN from the second REGNOT record to determine 
if the MINs are the same. If the MlNs are the same (in- 
dicating the same registered mobile user), processing 
continues at a step 410: otherwise^ processing contin- 
ues at a decision step 414. 

^o. In step 4 10/ the Iraud manager 304 handles a pos- 
sible clone detection, as discussed in greater detail be- 
low. Alter handling a possible clone detection, the fraud 
manager 304, in a step 41 2, notes that it should use the 
second REGNOT record in place of the first REGNOT 
record in future performances of step 406 and 410= so 
that future occurrences of the same MIN will be com- 
pared (in step 502, as described below) with the time 
stamp of the second REGNOT record rather than that 
of the first. 

30 In decision step 414, the fraud manager 304 deter- 

mines whether the entire clone detection window 306 
has been searched tor the occurrence of the MIN ob- 
tained in step 404 II the entire clone detection window 
306 has beeri searched, processing continues at a step 

35 416: otherwise, processing returns to step 406 to get a 
new second REGNOT record 31 6 from the clone detec- 
tion window 306 and continue searching for the same 
MIN. 

In step 416, the fraud manager 304 excludes from 
40 further consideration all REGNOT records 318 having 
the MIN obtained in step 404. In a step 416, the fraud 
manager 304 determines whether any REGNOT 
records 316 remain in the clone detection window 306 
that contain MINs that have not yet been checked tor 
45 cloning fraud. It no REGNOT records 316 remain to be 
checked, processing ends in a step 420; otherwise, 
processing returns to step 404 to get a new first REG- 
NOT record 31 6 containing a new MIN to check lor clon- 
ing fraud. 

so FIG . 5 illustrates the handling of possible clone de- 
tection o1 step 410 in greater detail. In a step 502, the 
fraud manager 304 computes a difference between time 
stamps of the first and second REGNOT records. In a 
step 504, the fraud manager 304 obtains the indicia 

SB identifying the originating MSCs from the first and sec- 
ond REGNOT records and uses them as indices to the 
clone detection time table 306 to retrieve a reasonable 
travel trme between the respective cells ot originating 
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MSCs. In a decision step 506. the traud manager 304 
delernnines whether the time stamp ditlerence obtained 
in step 502 is less than the reasonable travel time ob- 
tained trom the clone detection time table 308 in step 
504. II the time stamp ditlerence is less than the reason- 
able travel time, then cloning Uaud is likely to exist and 
processing continues at a step 508: otherwise, the han- 
dling o1 possible clone detection is complete (i e.. clon- 
ing traud does not exist) and processing continues at 
step 412. 

in siep 508. the traud manager 304 records a likely 
instance o1 cloning fraud in the clone record file 31 4. The 
traud manager stores the MIN, both originating MSCs, 
the clone detection time, and the time stamp ditlerence 
lor later action/reporting by the clone detection system 
210. In addition to a daily report ot cloning activity, such 
action/reporting may include an alarm displayed to per- 
sonnel in cellular mobile telephone system 200 or re- 
moval ot the suspected clone trom service. Atter step 
506, processing continues at step 412. 

While the invention has been particularly shown 
and described with reference to several preferred em- 
bodiments thereof, it will be understood by those skilled 
in the art that various changes in torm and details may 
be made therein without departing from the spirit and 
scope of the invention as defined in the appended 
claims. 



Claims 

1 . A method for proactively detecting cloning fraud in 
a mobile cellular telephone environment, compris- 
ing the steps of: 

(1) collecting a plurality of registration notifica- 
tions each represented by a registration notiti- 
caiion (REGNOT) record comprising a mobile 
identification number (MIN), a time stamp of 
said registration notification, and originating 
indicia identifying a cell where said registration 
notification originated: 

(2) detecting a first REGNOT record and a sec- 
ond REGNOT record having a common MIN; 

(3) computing a time ditlerence between time 
stamps of said first and second REGNOT 
records; and 

(4) determining thai cloning fraud involving said 
common MIN has likely occurred based on said 
time ditlerence. 

2. The method of claim 1, wherein step (4) comprises 
the step of comparing said time difference to a clone 
detection time corresponding to a reasonable tirrie 
needed to travel between cells identified by origi- 
nating indicias contained in said first and second 
REGNOT records. 
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The method ot claim. 2, wherein said clone detection 
time is stored in a clone detection lime table and 
retrieved using said originating indicias contained 
in said first and second REGNOT records as indices 
into said clone detection time table. 

A method for proactively delecting cloning fraud in 
a mobile cellular telephone environment, compris- 
ing the steps of: 

(1 ) storing a plurality of registration notifications 
each represented by a registration notification 
(REGNOT) records, each REGNOT record 
comprising a mobile identification number 
(1^1 N), a time stamp of said registration notifi- 
cation, and originating indicia identifying a cell 
where said registration notification originated: 

(2) forming a clone data window comprising a 
plurality of said REGNOT records occurring 
within a predetermined lime frame; 

(3) detecting in said clone data window's first 
REGNOT record and a second REGNOT 
record having a common MIN; 

(4) computing a time difference between time 
stamps of said first and second REGNOT 
records; 

(5) determining that cloning f raud involving said 
common MIN has likely occurred based on said 
time difference; and 

(6) recording said likely occurrence of cloning 
fraud involving said common MIN. 

The method of claim 4, wherein step (5) comprises 
the step ot comparing said time difference to a clone 
detection time corresponding to a reasonable time 
needed to travel between cells identified by origi- 
nating indicias contained in said first and second 
REGNOT records. 

The method of claim 5, wherein said clone detection 
time is stored in a clone detection time table and 
retrieved using said originating indicias contained 
in said first and second REGNOT records as indices 
into said clone detection time table. 

The method of claim 6, wherein said clone detection 
window is formed every 30 minutes and said pre- 
determined lime frame is the previous 6.5 hours. 

A computer-based system for proactively detecting 
cloning fraud in a mobile cellular telephone environ- 
ment, comprising 

storing means for storing a plurality of registra- 
tion notifications each represented by a regis- 
tration notification (REGNOT) record, each 
REGNOT record comprising a mobile identifi- 
calion number (MIN), a time stamp of* said reg- 
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istration notitication, and onginating indicia 
identilying fi cell where said registration nolifi- 

caiion originated 

delecting means tor detecting a tirst REGNO! 
record and a second REGNOT record having a - 
comnnon MIN; 

computing means lor computing a time differ- 
ence between time stamps o1 said first and sec- 
ond REGNOT records; 

means lor determining that cloning Iraud involv- to 
ing said common MIN has likely occurred 
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